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DETAILED ACTION 

1 . Claims 1-33 are pending in the application. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 

form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 

3. Claims 1 - 8, 16 - 19, 22, 25, 28, 29, 32 and 33 are rejected under 35 
U.S.C. 102(e) as being anticipated by U.S. Patent NO. 6,118,936 to Lauer. 

4. As to claim 1 6, Lauer teaches correlating [correlation of the different types of 
events is performed using programmable analysis rules; col. 3, line 57 - col. 4, line 5] 
network event messages [receives and processes information relating to network 
events; col. 3, lines 40 - 57] on a computer network comprising a message parsing 
service [receive network events 404, Fig. 4; col. 6, lines 43 - 52], an event correlation 
service [SNMS 300 to perform alarm correlation, Fig. 3; col. 5, lines 57 - 67], and a 
knowledge database [Network Topology Databases 334, Fig. 3; col. 5, lines 55 - 67] 
coupled together via a plurality of interfaces [the logical system components of SNMS 
300, Fig. 4; col. 6, lines 33 - 43], the method comprising the steps of: 
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receiving a raw event at the message parsing service [Receive Network Events 
component 404... receives network events from the various SS7 network elements; col. 
6, lines 43-54]; 

parsing the raw event by the message parsing service [component parses the 
events and sends them to Process Events 402; col. 6, lines 43 - 54]; 

transmitting the parsed event to the event correlation service [If it is an SS7- 
related event, Process Events 402 applies a selected algorithm, such as create alarm or 
correlate to existing alarm; col. 7, lines 32 - 40]; 

utilizing data stored in the knowledge database to derive an event from the 
parsed event [receives network topology and configuration data from the Network 
Topology Databases 334... this data is used to correlate network events and to perform 
impact assessments on such events; col. 6, lines 52 - 63]; and 

transmitting the derived event to one of a plurality of operator workstations [data 
from the Alarming 302 and Reporting 304 servers are transmitted to workstation sites, 
col. 6, lines 21 - 33; detailed process of the Display Alarms component 412 is 
illustrated. This process component provides the results of SNMS processing to the 
user (referred to as the "operator"); col. 12, lines 3-21] regardless of a significance of 
the derived event [all network events are input to the SNMS Alarming Server 302 for 
analysis and correlation; col. 5, lines 39 - 45]. 

5. As to claim 1 7, Lauer teaches transmitting the derived event from the event 
correlation service [If it is an SS7-related event, Process Events 402 applies a selected 
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algorithm, such as create alarm or correlate to existing alarm; col. 7, lines 32 - 40] to a 
network management service [Display Alarms component 412. ..includes the Graphical 
User Interface (GUI) and associated software which supports topology and alarm 
presentation, using data supplied by Process Events 402. It also supports user 
interactions, such as alarm clears, acknowledgments, and trouble ticket submissions; 
col. 7, lines 16-29] and transmitting the derived event from the network management 
service to one of a plurality of operator workstations [detailed process of the Display 
Alarms component 412 is illustrated. This process component provides the results of 
SNMS processing to the user (referred to as the "operator"); col. 12, lines 3 - 35]. 

6. As to claim 18, Lauer teaches correlating network event messages [correlation of 
the different types of events; col. 3, line 57 - col. 4, line 5] on a computer network 
comprising a network mediation service [SWIFT 326 and LSE 330 illustrates one 
embodiment of a typical telecommunications network in which different types of 
elements are in place requiring different transport mechanisms; col. 5, lines 18 - 39], a 
message parsing service [receive network events 404, Fig. 4; col. 6, lines 43 - 52], an 
event notification service [Process Events 402, which runs primarily on the SNMS 
Alarming Server 302, is responsible for receiving events from other SNMS components, 
processing these events; col. 6, lines 20 - 33], an event correlation service [SNMS 300 
to perform alarm correlation, Fig. 3; col. 5, lines 57 - 67], and a knowledge database 
[Network Topology Databases 334, Fig. 3; col. 5, lines 55 - 67] coupled together via a 
plurality of interfaces, the method comprising the steps of: 
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receiving a raw event at the network mediation service from an external 
computer network [receives network events from the various SS7 network 
elements... via systems such as SWIFT 326 and LSE 330; col. 6, lines 43 - 52]; 

transmitting the raw event to the message parsing service [Receive Network 
Events component 404... receives network events from the various SS7 network 
elements...via systems such as SWIFT 326 and LSE 330; col. 6, lines 43 - 52]; 

parsing the raw event by the message parsing service [component parses the 
events and sends them to Process Events 402; col. 6, lines 43 - 54]; 

transmitting the parsed event to the event correlation service [If it is an SS7- 
related event, Process Events 402 applies a selected algorithm, such as create alarm or 
correlate to existing alarm; col. 7, lines 32 - 40]; 

utilizing data stored in the knowledge database to derive an event from the 
parsed event [receives network topology and configuration data from the Network 
Topology Databases 334... this data is used to correlate network events and to perform 
impact assessments on such events; col. 6, lines 52 - 63]; and 

transmitting the derived event to one of a plurality of operator workstations [data 
from the Alarming 302 and Reporting 304 servers are transmitted to workstation sites, 
col. 6, lines 21 - 33; detailed process of the Display Alarms component 412 is 
illustrated. This process component provides the results of SNMS processing to the 
user (referred to as the "operator"); col. 12, lines 3-21], regardless of a significance of 
the derived event [all network events are input to the SNMS Alarming Server 302 for 
analysis and correlation; col. 5, lines 39 - 45]. 
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7. As to claim 1 9, Lauer teaches transmitting the raw event from the network 
mediation service to the event notification service [events are received by the SNMS 
Alarming Server 302 in a First In/First Out (FIFO) queue; col. 9, lines 25 - 33] and 
transmitting the raw event from the event notification service to the message parsing 
service [Receive Network Events component 404... receives network events from the 
various SS7 network elements. ..via systems such as SWIFT 326 and LSE 330; col. 6, 
lines 43 - 52]. 

8. As to claim 22, Lauer teaches transmitting the parsed event from the message 
parsing service to the event notification service [component parses the events and 
sends them to Process Events 402 for analysis; col. 43 - 54] and 

transmitting the parsed event from the event notification service to the event correlation 
service [If it is an SS7-related event, Process Events 402 applies a selected algorithm, 
such as create alarm or correlate to existing alarm; col. 7, lines 32 - 40]. 

9. As to claim 25, Lauer teaches transmitting the derived event from the event 
correlation service [If it is an SS7-related event, Process Events 402 applies a selected 
algorithm, such as create alarm or correlate to existing alarm; col. 7, lines 32 - 40] to 
the event notification service [Process Events 402, which runs primarily on the SNMS 
Alarming Server 302, is responsible for receiving events from other SNMS components, 
processing these events; col. 6, lines 20 - 33], transmitting the derived event from the 
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event notification service to the network management service [Display Alarms 
component 41 2. ..includes the Graphical User Interface (GUI) and associated software 
which supports topology and alarm presentation, using data supplied by Process Events 
402; col. 7, lines 16 - 29], and transmitting the derived event from the network 
management service to one of a plurality of operator workstations [data from the 
Alarming 302 and Reporting 304 servers are transmitted to workstation sites, col. 6, 
lines 21 - 33; detailed process of the Display Alarms component 412 is illustrated. This 
process component provides the results of SNMS processing to the user (referred to as 
the "operator"); col. 12, lines 3-21]. 

10. As to claim 28, Lauer teaches correlating [correlation of the different types of 
events; col. 3, line 57 - col. 4, line 5] network event messages [receives and processes 
information relating to network events; col. 3, lines 40 - 57] on a computer network 
comprising a network mediation service [SWIFT 326 and LSE 330 illustrates one 
embodiment of a typical telecommunications network in which different types of 
elements are in place requiring different transport mechanisms; col. 5, lines 18 - 39], a 
message parsing service [receive network events 404, Fig. 4; col. 6, lines 43 - 52], an 
event notification service [Process Events 402, which runs primarily on the SNMS 
Alarming Server 302, is responsible for receiving events from other SNMS components, 
processing these events; col. 6, lines 20 - 33], and a network management service 
[Display Alarms component 412...includes the Graphical User Interface (GUI) and 
associated software which supports topology and alarm presentation, using data 
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supplied by Process Events 402; col. 7, lines 16-29] coupled together via a plurality of 
interfaces, the method comprising the steps of: 

receiving a raw event at the network mediation service from an external 
computer network [receives network events from the various SS7 network 
elements.. .via systems such as SWIFT 326 and LSE 330; col. 6, lines 43 - 52]; 

transmitting the raw event to the message parsing service [Receive Network 
Events component 404. ..receives network events from the various SS7 network 
elements... via systems such as SWIFT 326 and LSE 330; col. 6, lines 43 - 52]; 

parsing the raw event by the message parsing service [component parses the 
events and sends them to Process Events 402; col. 6, lines 43 - 54]; 

transmitting the parsed event to the network management service [component 
parses the events and sends them to Process Events 402 for analysis; col. 43 - 54], 
regardless of a significance of the parsed event [all network events are input to the 
SNMS Alarming Server 302 for analysis and correlation; col. 5, lines 39 - 45]. 

11. As to claim 29, Lauer teaches transmitting the parsed event from the message 
parsing service to the event notification service [component parses the events and 
sends them to Process Events 402 for analysis; col. 43 - 54], and transmitting the 
parsed event from the event notification service to the network management service 
[Display Alarms component 412...includes the Graphical User Interface (GUI) and 
associated software which supports topology and alarm presentation, using data 
supplied by Process Events 402; col. 7, lines 16 - 29]. 
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12. As to claim 32, this is an apparatus claim that corresponds to method claim 16; 
note the rejection to claim 16 above, which also meets this apparatus claim. 

13. As to claim 33, this is a system claim that corresponds to method claim 18; note 
the rejection to claim 18 above, which also meet this system claim. 

14. As to claim 1 , Lauer teaches correlating network events [correlation of the 
different types of events is performed using programmable analysis rules; col. 3, line 57 
- col, 4, line 5] among a number of client services comprising: at least one computer 
comprising a memory having program instructions and a processor [Signaling Network 
Management System 300, Fig. 3; col. 4, lines 33 - 50] configured to use the program 
instructions to provide: 

a network management service [Display Alarms component 41 2. ..includes the 
Graphical User Interface (GUI) and associated software which supports topology and 
alarm presentation, using data supplied by Process Events 402; col. 7, lines 16-29]; 

an event notification service [Process Events 402, which runs primarily on the 
SNMS Alarming Server 302, is responsible for receiving events from other SNMS 
components, processing these events; col. 6, lines 20 - 33]; 

a network mediation service [SWIFT 326 and LSE 330 illustrates one 
embodiment of a typical telecommunications network in which different types of 
elements are in place requiring different transport mechanisms; col. 5, lines 18-39] 
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adapted to receive a raw event from an external computer network [various SS7 
network elements] and transmit the raw event to the event notification service [receives 
network events from the various SS7 network elements. ..via systems such as SWIFT 
326 and LSE 330; col. 6, lines 43 - 52]; 

a message parsing service adapted to receive a raw event from the event 
notification service [Receive Network Events component 404. ..receives network events 
from the various SS7 network elements. ..via systems such as SWIFT 326 and LSE 330; 
col. 6, lines 43 - 52], parse the raw event [component parses the events and sends 
them to Process Events 402; col. 6, lines 43 - 54], and transmit the parsed event to the 
event notification service [component parses the events and sends them to Process 
Events 402 for analysis; col. 43 - 54]; and 

an event correlation service [SNMS 300 to perform alarm correlation, Fig. 3; col. 
5, lines 57 - 67] coupled to a knowledge database comprising correlation knowledge 
[Network Topology Databases 334, Fig. 3; col. 5, lines 55 - 67], the event correlation 
service adapted to receive the parsed event from the event notification service [If it is an 
SS7-related event, Process Events 402 applies a selected algorithm, such as create 
alarm or correlate to existing alarm; col. 7, lines 32 - 40], utilize data stored in the 
knowledge database to derive an event from the parsed event [receives network 
topology and configuration data from the Network Topology Databases 334... this data 
is used to correlate network events and to perform impact assessments on such events; 
col. 6, lines 52 -63]; and 
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transmit the derived event to one of a plurality of operator workstations via the 
event notification service [data from the Alarming 302 and Reporting 304 servers are 
transmitted to workstation sites, col. 6, lines 21 - 33; detailed process of the Display 
Alarms component 412 is illustrated. This process component provides the results of 
SNMS processing to the user (referred to as the "operator"); col. 12, lines 3 - 21], 
regardless of a significance of the derived event [all network events are input to the 
SNMS Alarming Server 302 for analysis and correlation; col. 5, lines 39 - 45], wherein 
the network mediation, message parsing, event notification and network management 
services are coupled together via a plurality of interfaces [the logical system 
components of SNMS 300, Fig. 4; col. 6, lines 33 - 43]. 



15. As to claim 2, Lauer teaches the network mediation service is adapted to 
interface with at least one external computer network [SWIFT 326 and LSE 330 
illustrates one embodiment of a typical telecommunications network in which different 
types of elements are in place requiring different transport mechanisms; col. 5, lines 18 
-39]. 



16. As to claim 3, Lauer teaches receiving a raw event at the network mediation 
service [via systems such as SWIFT 326 and LSE 330] from the external computer 
network [various SS7 network elements] and transmitting the raw event to the message 
parsing service [Receive Network Events component 404... receives network events 
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from the various SS7 network elements... via systems such as SWIFT 326 and LSE 330; 
col. 6, lines 43 - 52]. 

17. As to claim 4, Lauer teaches the message parsing service is adapted to receive a 
raw event from the network mediation service [Receive Network Events component 
404.. .receives network events from the various SS7 network elements... via systems 
such as SWIFT 326 and LSE 330; col. 6, lines 43 - 52] and produce a parsed event 
[component parses the events and sends them to Process Events 402; col. 6, lines 43 - 
54]. 

18. As to claim 5, Lauer teaches the message parsing service is adapted to route the 
parsed event [component parses the events and sends them to Process Events 402; 
col. 6, lines 43 - 54] to the network management service [Display Alarms component 
412. ..includes the Graphical User Interface (GUI) and associated software which 
supports topology and alarm presentation, using data supplied by Process Events 402; 
col. 7, lines 16-29] via the event notification service [Process Events 402]. 



19. As to claim 6, Lauer teaches the message parsing service is adapted to route the 
parsed event [component parses the events and sends them to Process Events 402; 
col. 6, lines 43 - 54] to the event correlation service via the event notification service [If 
it is an SS7-related event, Process Events 402 applies a selected algorithm, such as 
create alarm or correlate to existing alarm; col. 7, lines 32 - 40]. 
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20. As to claim 7, Lauer teaches the network management service is adapted to 
interface with a plurality of operator workstations [Display Alarms component 

412. ..supports user interactions, such as alarm clears, acknowledgments, and trouble 
ticket submissions; col. 7, lines 16-29]. 

21 . As to claim 8, Lauer teaches receive data requests from the plurality of operator 
workstations [SNMS Alarming Server 302 has an interface with a Trouble Management 
System 342. This allows SNMS users at the client workstations 312 to submit trouble 
tickets for SNMS-generated alarms; col. 6, lines 13-21] and transmit the data requests 
to the event correlation service via the event notification service [Process Topology 
component 406... receives network topology and configuration data... from Manual 
Overrides 336; col. 6, lines 52 - 66]. 

Claim Rejections - 35 USC § 103 

22. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

23. Claims 9-15, 20, 21, 23, 24, 26, 27, 30 and 31 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Lauer in view of U.S. Patent NO. 6,477,585 to 
Cohen. 
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24. The reference to Cohen was cited in the previous office action. 

25. As to claim 9, Lauer teaches a queue [events are received by the SNMS 
Alarming Server 302 in a First In/First Out (FIFO) queue; col. 9, lines 25 - 33] for 
receiving a raw event [Receive Network Events component 404... receives network 
events from the various SS7 network elements; col. 6, lines 43 - 54], parsing the raw 
event [component parses the events and sends them to Process Events 402; col. 6, 
lines 43 - 54], a queue for receiving parsed events [queue is a First In/First Out (FIFO) 
queue that feeds the Process Events component 402 with network events; col. 8, lines 9 
- 30], correlating the parsed event [If it is an SS7-related event, Process Events 402 
applies a selected algorithm, such as create alarm or correlate to existing alarm; col. 7, 
lines 32 - 40], a database for storing derived events [active alarm database; col. 7, line 
56 - col. 8, line 5], transmitting the derived event to operator workstations [detailed 
process of the Display Alarms component 412 is illustrated. This process component 
provides the results of SNMS processing to the user (referred to as the "operator"); col. 
12, lines 3-21], and asynchronous communication of events [an Asynchronous Data 
Communications Network 320 is used to transport events; col. 5, lines 8-23]. 

26. Although Lauer clearly teaches the desire to store and handle the raw, parsed 
and derived event separately and providing asynchronous communication of event, 
Lauer does not specifically teach an event channel for each type of event. 
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However, Cohen teaches an event management service [col. 1 , lines 57 - 67] in 
a distributed computing environment [col. 2, lines 33 - 50] and event channels [column 
5, lines 38 - 61 ; column 9, lines 39 - 62]. 

27. It would have been obvious to a person of ordinarily skilled in the art at the time 
of the invention to apply the teaching of event channels as taught by Cohen to the 
invention of Lauer because event channels allow multiple suppliers to communicate with 
multiple consumers in an asynchronous way [col. 1 , lines 48 - 50 of Cohen] and allow 
events to be transparently supplied in an asynchronous manner [col. 1, lines 65 - 67 of 
Cohen]. 

28. As to claim 1 0, Lauer as modified teaches the event notification service is further 
comprised of at least one filter [filters are predefined, but can be modified by each 
operator to define the view that his/her GUI process will display; col. 12, lines 28 - 60 of 
Lauer]. 

29. As to claim 1 1 , Lauer as modified teaches at least one filter is coupled to at least 
one of the plurality of event channels [first stage filter for SVC events are the SVC 
routing destination SVC messages that are routed to EMS will be sent through the EMS 
event channel; col. 1 1 , lines 23 - 36 of Cohen]. 

30. As to claim 12, Lauer as modified teaches the raw event channel [EMS 22 acts 
as an "event channel" to uncouple one or more event suppliers 24a-24n from the one or 
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more event consumers 26a-26n; col. 5, lines 36 - 63 of Cohen] is.adapted to receive a 
raw event from the network mediation service [via systems such as SWIFT 326 and 
LSE 330 of Lauer] and transmit the raw event to the message parsing service [Receive 
Network Events component 404... receives network events from the various SS7 
network elements... via systems such as SWIFT 326 and LSE 330; col. 6, lines 43 - 52 
of Lauer]. 

31 . As to claim 13, Lauer as modified teaches the parsed event channel [EMS 22 
acts as an "event channel" to uncouple one or more event suppliers 24a-24n from the 
one or more event consumers 26a-26n; col. 5, lines 36 - 63 of Cohen] is adapted to 
receive a parsed event from the message parsing service [component parses the 
events and sends them to Process Events 402; col. 6, lines 43 - 54 of Lauer], and 
transmit the parsed event to the network management service [Display Alarms 
component 41 2. ..includes the Graphical User Interface (GUI) and associated software 
which supports topology and alarm presentation, using data supplied by Process Events 
402; col. 7, lines 16 - 29 of Lauer]. 

32. As to claim 14, Lauer as modified teaches the parsed event channel [EMS 22 
acts as an "event channel" to uncouple one or more event suppliers 24a-24n from the 
one or more event consumers 26a-26n; col. 5, lines 36 - 63 of Cohen] is adapted to 
receive a parsed event from the message parsing service [component parses the 
events and sends them to Process Events 402; col. 6, lines 43 - 54 of Lauer] and 
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transmit the parsed event to the event correlation service [If it is an SS7-related event, 
Process Events 402 applies a selected algorithm, such as create alarm or correlate to 
existing alarm; col. 7, lines 32 - 40 of Lauer]. 

33. As to claim 15, Lauer as modified teaches the derived event channel [EMS 22 
acts as an "event channel" to uncouple one or more event suppliers 24a-24n from the 
one or more event consumers 26a-26n; col. 5, lines 36 - 63 of Cohen] is adapted to 
receive a derived event from the event correlation service [If it is an SS7-related event, 
Process Events 402 applies a selected algorithm, such as create alarm or correlate to 
existing alarm; col. 7, lines 32 - 40 of Lauer], and transmit the derived event to network 
management service [Display Alarms component 41 2. ..includes the Graphical User 
Interface (GUI) and associated software which supports topology and alarm 
presentation, using data supplied by Process Events 402; col. 7, lines 16 - 29 of Lauer]. 

34. As to claim 20, this is rejected for the same reason as claim 1 2 above. 

35. As to claim 21 , Lauer as modified teaches transmitting the raw event from the 
raw event channel [EMS 22 acts as an "event channel" to uncouple one or more event 
suppliers 24a-24n from the one or more event consumers 26a-26n; col. 5, lines 36 - 63 
of Cohen] to at least one event filter [Event Filters; col. 11, lines 13 - 54 of Cohen] and 
transmitting the raw event from the at least one event filter to the message parsing 
service [Receive Network Events component 404... receives network events from the 
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various SS7 network elements... via systems such as SWIFT 326 and LSE 330; col. 6, 
lines 43 - 52 of Lauer]. 

36. As to claim 23, this is rejected for the same reason as claim 14 above. 

37. As to claim 24, Lauer as modified teaches transmitting the processed event from 
the parsed event channel [EMS 22 acts as an "event channel" to uncouple one or more 
event suppliers 24a-24n from the one or more event consumers 26a-26n; col. 5, lines 
36 - 63 of Cohen] to at least one event filter [Event Filters; col. 11, lines 13 - 54 of 
Cohen], and transmitting the processed event from the at least one event filter to the 
event correlation service [If it is an SS7-related event, Process Events 402 applies a 
selected algorithm, such as create alarm or correlate to existing alarm; col. 7, lines 32 - 
40 of Lauer]. 

38. As to claim 26, this is rejected for the same reasons as claim 1 5 above. 

39. As to claim 27, Lauer as modified teaches transmitting the processed event from 
the derived event channel [EMS 22 acts as an "event channel" to uncouple one or more 
event suppliers 24a-24n from the one or more event consumers 26a-26n; col. 5, lines 
36 - 63 of Cohen] to at least one event filter [Event Filters; col. 1 1, lines 13 - 54 of 
Cohen], and transmitting the processed event from the at least one event filter to the 
network management service [Display Alarms component 412. ..includes the Graphical 
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User Interface (QUI) and associated software which supports topology and alarm 
presentation, using data supplied by Process Events 402; col. 7, lines 16 - 29 of Lauer]. 

40. As to claim 30, Lauer as modified teaches receiving the parsed event at a parsed 
event channel [EMS 22 acts as an "event channel" to uncouple one or more event 
suppliers 24a-24n from the one or more event consumers 26a-26n; col. 5, lines 36 - 63 
of Cohen], processing the parsed event by the parsed event channel [component 
parses the events and sends them to Process Events 402; col. 6, lines 43 - 54 of 
Lauer], and transmitting the processed event from the parsed event channel to the 
network management service [Display Alarms component 41 2. ..includes the Graphical 
User Interface (GUI) and associated software which supports topology and alarm 
presentation, using data supplied by Process Events 402; col. 7, lines 16 - 29 of Lauer]. 

41 . As to claim 31 , Lauer as modified teaches transmitting the processed event from 
the parsed event channel [EMS 22 acts as an "event channel" to uncouple one or more 
event suppliers 24a-24n from the one or more event consumers 26a-26n; col. 5, lines 
36 - 63 of Cohen] to at least one event filter [Event Filters; col. 1 1 , lines 1 3 - 54 of 
Cohen], and transmitting the processed event from the at least one event filter to the 
network management service [Display Alarms component 41 2. ..includes the Graphical 
User Interface (GUI) and associated software which supports topology and alarm 
presentation, using data supplied by Process Events 402; col. 7, lines 16 - 29 of Lauer]. 
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Response to Arguments 

42. Applicant's arguments filed June 20, 2004 have been fully considered but they 
are not persuasive. 

43. Applicant argues (1 ) Lauer does not teach at least "an event correlation service 
coupled to a knowledge database comprising correlation knowledge, said event 
correlation service adapted to: receive said parsed event from said event notification 
service; utilize data stored in said knowledge database to derive an event from said 
parsed event; and transmit said derived event to one of a plurality of operator 
workstations via said event notification service, regardless of a significance of said 
derived event" [p. 15, lines 12 - 17; p. 15, line 21 - p. 16, line 2; p. 16, lines 3 -21] and 
(2) there is no motivation of suggestion to combine the disclosure of Lauer with that of 
Cohen [p. 18, lines 7-9]. 

44. As to argument (1 ), examiner respectfully disagrees and submits that Lauer 
teaches all the limitations of the claims 1 - 8, 16 - 19, 22, 25, 28, 29, 32 and 33. In 
rejecting the claims, the examiner mapped all of the claimed limitations and cited 
corresponding passages to the Lauer reference. Applicant's arguments simply states 
that at least some of the limitations in the claims are not taught by Lauer but fails to 
explain why the examiner's mappings of the claimed limitations are not proper. After a 
careful review of the rejection for the claims, examiner submits that Lauer teaches the 
claimed limitations and the rejection is deemed proper. For example Lauer teaches "an 
event correlation service [SNMS 300 to perform alarm correlation, Fig. 3; col. 5, lines 57 
- 67] coupled to a knowledge database comprising correlation knowledge [Network 



Application/Control Number: 09/577,071 Page 21 

Art Unit: 2126 

Topology Databases 334, Fig. 3; col. 5, lines 55 - 67], said event correlation service 
adapted to: receive said parsed event from said event notification service [If it is an 
SS7-related event, Process Events 402 applies a selected algorithm, such as create 
alarm or correlate to existing alarm; col. 7, lines 32 - 40]; utilize data stored in said 
knowledge database to derive an event from said parsed event [receives network 
topology and configuration data from the Network Topology Databases 334... this data 
is used to correlate network events and to perform impact assessments on such events; 
col. 6, lines 52 - 63]; and transmit said derived event to one of a plurality of operator 
workstations via said event notification service [data from the Alarming 302 and 
Reporting 304 servers are transmitted to workstation sites, col. 6, lines 21 - 33; detailed 
process of the Display Alarms component 412 is illustrated. This process component 
provides the results of SNMS processing to the user (referred to as the "operator"); col. 
12, lines 3 - 21], regardless of a significance of said derived event [all network events 
are input to the SNMS Alarming Server 302 for analysis and correlation; col. 5, lines 39 
-45]." 

45. In response to argument (2), the examiner recognizes that obviousness can only 
be established by combining or modifying the teachings of the prior art to produce the 
claimed invention where there is some teaching, suggestion, or motivation to do so 
found either in the references themselves or in the knowledge generally available to one 
of ordinary skill in the art. In this case, the motivation to combine the references can be 
found in col. 1, lines 48 - 50 and 65 - 67 of Cohen [also see rejection above]. 
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Conclusion 

46. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

47. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Li B. Zhen whose telephone number is (571 ) 272-3768. 
The examiner can normally be reached on Mon - Fri, 8:30am - 5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Meng-Ai An can be reached on (571) 272-3756. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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